elanous 0.2.42 → 0.2.43

package/src/cli/intake-source-cli.ts

@@ -1,23 +1,44 @@
 import type { Command } from 'commander';
 import { randomUUID } from 'node:crypto';
+import { resolve } from 'node:path';
 import { effectiveInstanceRoot } from '../instance/resolve.js';
-import { addSource, canonicalSeat, dueSources, expiredSource, listSources, removeSource, runDue, type SourceKind } from '../intake-plane/intake-sources.js';
+import { addSource, canonicalSeat, dueSources, expiredSource, listSources, removeSource, runDue, type RunDueDeps, type SourceKind } from '../intake-plane/intake-sources.js';
+import { projectTopicBriefing, subscribeTopicSearch, type SubscribeTopicSearchInput } from '../intake-plane/actions.js';
+import { runIntakeIssueBriefing } from '../intake-plane/actions.js';
 
-export function registerIntakeSourceCommands(intake: Command, root: () => string = effectiveInstanceRoot): void {
+export function registerIntakeSourceCommands(intake: Command, root: () => string = effectiveInstanceRoot,
+  deps: { subscribeTopicSearch?: (input: SubscribeTopicSearchInput, options?: { stateDir?: string; runDeps?: RunDueDeps }) => ReturnType<typeof subscribeTopicSearch> } = {}): void {
   const source = intake.command('source').description('자리별 흡수 원천과 주기 등록·조회·실행');
   const fail = (error: unknown) => { console.error(error instanceof Error ? error.message : String(error)); process.exitCode = 2; };
   source.command('add')
     .requiredOption('--seat <id>', '자리 id 또는 별칭')
-    .requiredOption('--kind <kind>', 'github-query | rss | command')
+    .requiredOption('--kind <kind>', 'github-query | rss | command | topic-search')
     .requiredOption('--spec <spec>', 'GitHub 질의 · 피드 URL · 명령')
     .requiredOption('--every <cadence>', 'Nh | Nd | Nw')
     .option('--until <date>', '만료 시작 날짜 YYYY-MM-DD (UTC)')
     .option('--why <reason>', '등록 이유')
     .option('--id <id>', '원천 id')
-    .action((opts: { seat: string; kind: string; spec: string; every: string; until?: string; why?: string; id?: string }) => {
+    .option('--linear-issue-id <uuid>', 'topic-search parent Linear issue UUID')
+    .option('--schedule-cron <expression>', 'topic-search schedule registry cron (e.g. 0 8 * * 1)')
+    .option('--telegram-dry-run-file <path>', 'Telegram 브리핑 본문을 이 파일에 기록하고 실제 발송은 하지 않음 (topic-search)')
+    .action(async (opts: { seat: string; kind: string; spec: string; every: string; until?: string; why?: string; id?: string; linearIssueId?: string; scheduleCron?: string; telegramDryRunFile?: string }) => {
       try {
+        if (opts.kind === 'topic-search') {
+          if (!opts.linearIssueId || !opts.scheduleCron) throw new Error('topic-search 는 --linear-issue-id 와 --schedule-cron 이 필요하다');
+          const telegramDryRunFile = opts.telegramDryRunFile ? resolve(opts.telegramDryRunFile) : undefined;
+          const result = await (deps.subscribeTopicSearch ?? subscribeTopicSearch)({ seat: opts.seat, topic: opts.spec,
+            linearIssueId: opts.linearIssueId, every: opts.every, scheduleCron: opts.scheduleCron,
+            ...(telegramDryRunFile ? { telegramDryRunFile } : {}) },
+          { stateDir: root(), runDeps: { projectTopicBriefing: telegramDryRunFile
+            ? (registered, items, stateDir) => projectTopicBriefing(registered, items, stateDir, { telegramDryRunFile })
+            : projectTopicBriefing } });
+          console.log(`${result.source.id}  ${result.source.seat}  topic-search  ${result.source.every}  schedule=${result.scheduleId}  immediate=${result.immediate.ran.map(row => row.items).join(',')}`);
+          return;
+        }
         const added = addSource({ id: opts.id ?? `src-${randomUUID().slice(0, 8)}`, seat: opts.seat, kind: opts.kind as SourceKind,
-          spec: opts.spec, every: opts.every, ...(opts.until ? { until: opts.until } : {}), ...(opts.why ? { why: opts.why } : {}) }, root());
+          spec: opts.spec, every: opts.every, ...(opts.until ? { until: opts.until } : {}), ...(opts.why ? { why: opts.why } : {}),
+          ...(opts.linearIssueId ? { linearIssueId: opts.linearIssueId } : {}),
+          ...(opts.scheduleCron ? { scheduleCron: opts.scheduleCron } : {}) }, root());
         console.log(`${added.id}  ${added.seat}  ${added.kind}  ${added.every}`);
       } catch (error) { fail(error); }
     });
@@ -38,18 +59,33 @@ export function registerIntakeSourceCommands(intake: Command, root: () => string
   });
   source.command('run-due')
     .option('--seat <id>', '자리 id 또는 별칭')
+    .option('--source-id <id>', '단일 입력원만 실행 (스케줄 레지스트리 호출용)')
+    .option('--project-issue-briefing', 'topic-search 결과를 관련 Linear 이슈의 Telegram·코멘트에 투영')
+    .option('--telegram-dry-run-file <path>', 'Telegram 브리핑 본문을 이 파일에 기록하고 실제 발송은 하지 않음')
     .option('--dry-run', '기한 원천 목록만 · 수집·원장·마지막 실행 시각 무변')
     .option('--json', 'JSON 출력')
-    .action(async (opts: { seat?: string; dryRun?: boolean; json?: boolean }) => {
+    .action(async (opts: { seat?: string; sourceId?: string; projectIssueBriefing?: boolean; telegramDryRunFile?: string; dryRun?: boolean; json?: boolean }) => {
       try {
         const seat = opts.seat === undefined ? undefined : canonicalSeat(opts.seat);
         if (opts.dryRun) {
-          const sources = dueSources(new Date(), root()).filter((entry) => seat === undefined || entry.seat === seat);
+          const sources = dueSources(new Date(), root(), opts.sourceId).filter((entry) => seat === undefined || entry.seat === seat);
           if (opts.json) console.log(JSON.stringify(sources));
           else for (const entry of sources) console.log(`${entry.id}  ${entry.seat}  ${entry.kind}  ${entry.every}`);
           return;
         }
-        const result = await runDue({ seat, deps: { stateDir: root() } });
+        const telegramDryRunFile = opts.telegramDryRunFile ? resolve(opts.telegramDryRunFile) : undefined;
+        const result = await runDue({ seat, sourceId: opts.sourceId, deps: { stateDir: root(),
+          ...(opts.projectIssueBriefing || telegramDryRunFile ? { projectTopicBriefing: telegramDryRunFile
+            ? (registered, items, stateDir) => projectTopicBriefing(registered, items, stateDir, { telegramDryRunFile })
+            : projectTopicBriefing } : {}),
+          onCollected: async (source, raws) => {
+          if (!source.issueRef) return;
+          await runIntakeIssueBriefing({
+            issueRef: source.issueRef, topic: source.spec, state: 'open', collected: true,
+            evidence: raws.filter(raw => typeof raw.url === 'string' && raw.url.trim().length > 0)
+              .map(raw => ({ title: raw.title || source.spec, url: raw.url!, summary: raw.text || raw.title || source.spec })),
+          }, { stateDir: root() });
+        } } });
         if (opts.json) console.log(JSON.stringify(result));
         else for (const row of result.ran) console.log(`${row.id}  ${row.items}${row.error ? `  실패: ${row.error}` : ''}`);
         if (result.ran.some((row) => row.error)) process.exitCode = 1;

package/src/cli/msg-cli.ts

@@ -3,7 +3,7 @@ import { mkdirSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { ensureAuthToken } from '../auth/acp-token.js';
 import { elanousStateRoot } from '../autopilot/state-paths.js';
-import { canonicalSeatId, openMsgStore, openMsgStoreReadOnly, type Message, type MsgStore } from '../msg/msg-store.js';
+import { canonicalMessageAddress, canonicalSeatId, openMsgStore, openMsgStoreReadOnly, type Message, type MsgStore } from '../msg/msg-store.js';
 import { clearPostOffice, ensurePostOffice, writePostOffice } from '../msg/msg-post-office.js';
 import { acquireLockSync } from '../storage/file-lock.js';
 import { GitHubMsgMirrorTransport } from '../msg/msg-mirror-github.js';
@@ -325,7 +325,8 @@ export function registerMsgCommands(program: Command, deps: MsgCliDeps = {}): vo
       const from = seat(opts.from, '--from');
       const unsupported = opts.to === undefined ? null : unsupportedLoopAddressNotice(opts.to);
       if (unsupported) out.error(unsupported);
-      const to = seat(opts.to, '--to');
+      if (opts.to === undefined) throw new Error('--to is required');
+      const to = canonicalMessageAddress(opts.to);
       // Validate the auto-reply target before saving — a mismatched flag must not leave a stored message behind.
       const agentAddress = agentReplyAddress(opts.agentReply);
       if (agentAddress !== null) requireAgentTarget(agentAddress, to);
@@ -364,7 +365,7 @@ export function registerMsgCommands(program: Command, deps: MsgCliDeps = {}): vo
   msg.command('route <address>').description('Show how a post to this address is read (replyBody) and woken (wake)')
     .option('--json')
     .action((address: string, opts: CommonOptions) => run(() => {
-      const to = canonicalSeatId(address);
+      const to = canonicalMessageAddress(address);
       const wake = resolveWake(to, deps.wakeDeps);
       const row = { msgAddress: to, replyBody: messageRouteFor(to)?.replyBody ?? null, ...wake };
       emit(row, opts.json, () => out.log(`${to}\treplyBody=${row.replyBody ?? '모름'}\twake=${wake.wake}`
@@ -372,6 +373,34 @@ export function registerMsgCommands(program: Command, deps: MsgCliDeps = {}): vo
         + `\t(${wake.source}${wake.reason ? `: ${wake.reason}` : ''})`));
     })());
 
+  const group = msg.command('group').description('Manage local message group subscriptions');
+  group.command('create <name>').description('Create a group and subscribe its owner')
+    .requiredOption('--from <seat>', 'seat creating and owning the group').option('--json')
+    .action((name: string, opts: { from: string; json?: boolean }) => run(() => {
+      const address = withStore(store => store.createGroup(name, opts.from));
+      emit({ address, owner: canonicalSeatId(opts.from) }, opts.json, () => out.log(`${address} created; ${canonicalSeatId(opts.from)} subscribed`));
+    })());
+  group.command('join <name>').description('Subscribe a seat to a group')
+    .requiredOption('--seat <seat>').option('--json')
+    .action((name: string, opts: { seat: string; json?: boolean }) => run(() => {
+      const joined = withStore(store => store.joinGroup(name, opts.seat));
+      const row = { group: canonicalMessageAddress(name.startsWith('group:') ? name : `group:${name}`), seat: canonicalSeatId(opts.seat), joined };
+      emit(row, opts.json, () => out.log(`${row.seat} ${row.joined ? 'joined' : 'already subscribed'} ${row.group}`));
+    })());
+  group.command('leave <name>').description('Unsubscribe a seat from a group')
+    .requiredOption('--seat <seat>').option('--json')
+    .action((name: string, opts: { seat: string; json?: boolean }) => run(() => {
+      const left = withStore(store => store.leaveGroup(name, opts.seat));
+      const row = { group: canonicalMessageAddress(name.startsWith('group:') ? name : `group:${name}`), seat: canonicalSeatId(opts.seat), left };
+      emit(row, opts.json, () => out.log(`${row.seat} ${row.left ? 'left' : 'was not subscribed to'} ${row.group}`));
+    })());
+  group.command('list').description('List a seat’s active group subscriptions')
+    .requiredOption('--seat <seat>').option('--json')
+    .action((opts: { seat: string; json?: boolean }) => run(() => {
+      const groups = withStore(store => store.listGroups(opts.seat));
+      emit(groups, opts.json, () => { if (!groups.length) out.log('No groups.'); else for (const address of groups) out.log(address); });
+    })());
+
   msg.command('list').description('List messages for one recipient or one thread without acknowledging them')
     .option('--to <seat>').option('--thread <id>', 'request ID; list it and its replies, regardless of recipient')
     .option('--after <id>', 'exclusive message ID (default: acknowledged cursor for a recipient, 0 for a thread)')

package/src/cli/pr-cli.ts

@@ -37,6 +37,7 @@ import {
   type CmdRunner,
   type PrManager,
 } from '../autopilot/pr-manager.js';
+import { observePrLineage } from '../pr-tool/census.js';
 import {
   collectBaseLandingCommits,
   computeGranularityStats,
@@ -68,6 +69,7 @@ import { ensurePrLandHeavyRemote, type HeavyRemoteInput, type HeavyRemoteResult
 import { readPrBaseNameWithRetry } from './pr-land-base-read.js';
 import { runHeavyOnPodShadow } from './pr-land-pod-shadow.js';
 import type { LandingPodShadowInput, LandingPodShadowVerdict } from './pr-land-pod-shadow-job.js';
+import { recordWarmReuseEvidence, warmReuseEvidencePath } from '../task-orchestrator/surfaces/warm-reuse-evidence.js';
 import { readTaskAgentState, taskAgentStatePath, type TaskCard } from '../task-agent/task-hand.js';
 import { INFLIGHT_REGISTRY_FILE, removeInflightForPr } from '../pr-tool/inflight-registry.js';
 import { PR_LABEL_NAMES } from '../github/pr-labels.js';
@@ -1899,10 +1901,19 @@ export async function runPrLand(opts: PrLandOpts = {}, deps: PrLandDeps = {}): P
         local: { measured: verdict.rootPlan != null, ok: verdict.ok, rootPlan: verdict.rootPlan ?? null },
         runPod: async () => {
           const runPod = deps.runLandingPodShadow ?? (await import('./pr-land-pod-shadow-job.js')).runLandingPodShadowJob;
-          return runPod({ head: opts.expectedHead!, main });
+          return runPod({ pr: Number(opts.pr), repo: cwd, host: verdict.host ?? '', head: opts.expectedHead!, main });
         },
         log: (category, event, data) => debug.log(category, event, { ...data, main, phase: 'initial' }),
         warn: (message) => out.error(`⚠ heavy-on-pod-shadow: ${message}`),
+        onShadow: ({ pod, agree }) => {
+          const shadow = pod && typeof pod === 'object' ? pod as LandingPodShadowVerdict : undefined;
+          const warm = shadow?.warmEvidence;
+          recordWarmReuseEvidence(warmReuseEvidencePath(), {
+            schema: 1, consumer: 'land', pr: Number(opts.pr), head: opts.expectedHead!, main, recordedAt: new Date().toISOString(),
+            ...(warm ? { ...warm, agree: warm.agree && agree } : {}),
+            ...(!warm ? { reason: shadow?.warmReason ?? 'warm-shadow-unmeasured' } : {}),
+          });
+        },
       });
     }
   }
@@ -2536,6 +2547,15 @@ export function registerPrCommands(program: Command, deps: PrLandDeps = {}, queu
       try { await supersedeMerged(number, opts.cwd ?? process.cwd()); }
       catch (error) { prToolOut.error(`✗ supersede-drafts: ${String(error)}`); prToolExit(1); }
     });
+  pr.command('lineage <pr>')
+    .description('PR 계보의 관측 사실만 JSON으로 읽기 (첫 조각 · 닫기 판정 없음)')
+    .requiredOption('--json', 'JSON 관측 결과 출력')
+    .option('--cwd <path>', '저장소 경로')
+    .action((rawPr: string, opts: { cwd?: string }) => {
+      const result = observePrLineage({ pr: Number(rawPr), run: prToolRun, cwd: opts.cwd });
+      prToolOut.log(JSON.stringify(result));
+      if (result.status === 'unknown') prToolExit(1);
+    });
   pr.command('census')
     .description('열린 PR 전체·골 문서만·2일 무커밋 draft·미닫힌 superseded 집계')
     .option('--cwd <path>', '저장소 경로')

package/src/cli/pr-land-heavy-remote.ts

@@ -8,6 +8,7 @@ import { debug, redactSecretText } from '../debug/log.js';
 import { gateRemoteHostCap, realGateRemoteRunner, resolveGateRemoteSettings, runOnRemote, type GateRemoteRunner, type RemoteRunOutcome } from '../self-implement/gate-remote.js';
 import { decideWarmReuse, type WarmReuseEvidenceByConsumer, type WarmReuseSwitchConfig } from '../task-orchestrator/surfaces/pod-warm-switch.js';
 import { buildLandWarmEvidence, type LandShadowSampleWindow } from './pr-land-pod-shadow-job.js';
+import { readWarmReuseEvidence, warmReuseEvidencePath, type WarmReuseEvidenceRow } from '../task-orchestrator/surfaces/warm-reuse-evidence.js';
 
 const SHA = /^[0-9a-f]{40}$/i;
 // This is the stable fallback order when settings.host is unavailable; an explicitly configured allowlisted host
@@ -18,7 +19,7 @@ export type PrLandHeavyHost = typeof PR_LAND_HEAVY_HOSTS[number];
 const allowedHost = (host: string): host is PrLandHeavyHost => PR_LAND_HEAVY_HOSTS.some((candidate) => candidate === host);
 
 export interface HeavyRemoteEvidence {
-  schema: 2;
+  schema: 3;
   pr: number;
   head: string;
   main: string;
@@ -72,6 +73,42 @@ export interface HeavyRemoteDeps {
   warmReuseConfig?: () => WarmReuseSwitchConfig | undefined;
   /** WARM-REUSE-LAND-CONSUMER-WIRE — land shadow Job 결과 창 seam(기본 없음 = 증거 없음 = off). */
   landShadowSamples?: () => LandShadowSampleWindow | undefined;
+  /** Durable shadow journal reader seam. */
+  readWarmEvidence?: (identity: { consumer: 'land' | 'gate-recheck'; pr: number; head: string; main: string }) => WarmReuseEvidenceRow[] | undefined;
+  warmEvidencePath?: () => string;
+}
+
+function journalLandShadowSamples(input: HeavyRemoteInput, deps: HeavyRemoteDeps): LandShadowSampleWindow | undefined {
+  const read = deps.readWarmEvidence ?? ((identity) => readWarmReuseEvidence(
+    (deps.warmEvidencePath ?? warmReuseEvidencePath)(), identity));
+  const rows = read({ consumer: 'land', pr: input.pr, head: input.head, main: input.main });
+  if (!rows?.length) return undefined;
+  const samples = rows.map((row) => ({ head: row.head, main: row.main,
+    lock: row.expectedLockHash ?? '', leaseValid: row.leaseValid === true && !!row.leaseId && !!row.workerId
+      && row.generation !== undefined && row.expectedLockHash === row.workerLockHash,
+    canaryPassed: row.canaryPassed === true, agree: row.agree === true }));
+  const latest = rows[rows.length - 1]!;
+  const gateRows = read({ consumer: 'gate-recheck', pr: input.pr, head: input.head, main: input.main });
+  let gateRecheck: LandShadowSampleWindow['gateRecheck'];
+  if (gateRows?.length) {
+    let consecutiveMatchSamples = 0;
+    for (let i = gateRows.length - 1; i >= 0; i--) {
+      const row = gateRows[i]!;
+      if (row.workerId !== latest.workerId || row.expectedLockHash !== latest.expectedLockHash
+        || row.workerLockHash !== row.expectedLockHash || row.leaseValid !== true
+        || !row.leaseId || row.generation === undefined
+        || row.canaryPassed !== true || row.agree !== true) break;
+      consecutiveMatchSamples++;
+    }
+    const latestGate = gateRows[gateRows.length - 1]!;
+    gateRecheck = { consecutiveMatchSamples, recentMismatchCount: gateRows.filter((row) => row.agree === false).length,
+      leaseValid: latestGate.leaseValid === true && !!latestGate.leaseId && !!latestGate.workerId && latestGate.generation !== undefined,
+      canaryPassed: latestGate.canaryPassed === true,
+      expected: { head: input.head, main: input.main, lock: latestGate.expectedLockHash },
+      worker: { head: input.head, main: input.main, lock: latestGate.workerLockHash } };
+  }
+  const lock = latest.expectedLockHash ?? '';
+  return { samples, lock, ...(gateRecheck ? { gateRecheck } : {}) };
 }
 
 function evidencePath(input: HeavyRemoteInput): string {
@@ -83,7 +120,7 @@ function validRootPlan(value: unknown): value is RootPlanSummary | null {
   if (!value || typeof value !== 'object') return false;
   const plan = value as Partial<RootPlanSummary>;
   return (plan.mode === 'affected' || plan.mode === 'full')
-    && (plan.roots === null || (Number.isSafeInteger(plan.roots) && plan.roots >= 0))
+    && (plan.roots === null || (typeof plan.roots === 'number' && Number.isSafeInteger(plan.roots) && plan.roots >= 0))
     && typeof plan.promoted === 'boolean'
     && (plan.reason === null || typeof plan.reason === 'string');
 }
@@ -92,7 +129,7 @@ function matchingEvidence(path: string, input: HeavyRemoteInput): HeavyRemoteEvi
   if (!existsSync(path)) return null;
   try {
     const data: HeavyRemoteEvidence = JSON.parse(readFileSync(path, 'utf8'));
-    return data.schema === 2 && data.pr === input.pr && data.head === input.head
+    return data.schema === 3 && data.pr === input.pr && data.head === input.head
       && data.main === input.main && allowedHost(data.host) && Number.isFinite(data.elapsedMs)
       && typeof data.interferenceMeasured === 'boolean' && validRootPlan(data.rootPlan) ? data : null;
   } catch { return null; }
@@ -232,7 +269,8 @@ export function ensurePrLandHeavyRemote(input: HeavyRemoteInput, deps: HeavyRemo
   }
   try {
     warmStage = 'evidence';
-    warmEvidence = buildLandWarmEvidence(deps.landShadowSamples?.(), { head: input.head, main: input.main });
+    const samples = deps.landShadowSamples ? deps.landShadowSamples() : journalLandShadowSamples(input, deps);
+    warmEvidence = buildLandWarmEvidence(samples, { head: input.head, main: input.main });
   } catch (error) {
     debug.log('pod.warm', 'land-shadow-unavailable', {
       pr: input.pr, stage: warmStage, reason: 'warm-evidence-read-failed',
@@ -266,7 +304,7 @@ export function ensurePrLandHeavyRemote(input: HeavyRemoteInput, deps: HeavyRemo
           // then run typecheck and self gate (changed tests and PWA reach/build) at that exact pair.
           // The detached integration commit stays on the selected host and never changes the PR branch.
           argv: (sha) => ['sh', '-c',
-          'git -c user.name=elanous-gate -c user.email=gate@localhost -c commit.gpgsign=false merge --no-ff --no-edit "$1" && TSC_BASE_REF="$1" bun run scripts/ci-typecheck-changed.ts --local && bun bin/elanous.mjs self gate --changed --base "$1" --local --shards 4 && bun scripts/pr-land-extra-remote-gates.ts "$1"',
+          'git -c user.name=elanous-gate -c user.email=gate@localhost -c commit.gpgsign=false merge --no-ff --no-edit "$1" && bash scripts/ci-typecheck-main-delta.sh "$1" && bun bin/elanous.mjs self gate --changed --base "$1" --local --shards 4 && bun scripts/pr-land-extra-remote-gates.ts "$1"',
           'sh', sha(input.main)],
         }, deps.runner ?? realGateRemoteRunner);
       } catch (error) {
@@ -309,7 +347,7 @@ export function ensurePrLandHeavyRemote(input: HeavyRemoteInput, deps: HeavyRemo
     return { ok: false, host: selectedHost, attemptedHost: selectedHost, source: 'unmeasured', reason, elapsedMs, evidencePath: path, ...(failureLogPath ? { failureLogPath } : {}) };
   }
   const evidence: HeavyRemoteEvidence = {
-    schema: 2, pr: input.pr, head: input.head, main: input.main, host: selectedHost,
+    schema: 3, pr: input.pr, head: input.head, main: input.main, host: selectedHost,
     passedAt: new Date().toISOString(), elapsedMs: outcome.ms, rootPlan: rootPlanFromOutput(outcome.stdout),
     interferenceMeasured: extraGates.interferenceMeasured,
   };

package/src/cli/pr-land-overlap-evidence.ts

@@ -14,6 +14,9 @@
  *   ③ 리뷰 — 증거가 가리키는 `review-results/<card>-<pr>-<head접두 10~40>.json`(TA 가 받는 `self review --json` stdout)이
  *      파일명에서 같은 PR·머리 접두이고 내용에서 전체 PR·머리가 정확히 같으며 `reviewed:true` · `verdict ∈ {pass, warn}` · must-fix 가 «잰 수» 0 인가
  *      (자동 병합 canAuto · TA-LAND-WARN-MUSTFIX0 과 같은 규칙 — must-fix 를 못 셌으면 거부).
+ *   ③' 공급자(PRLAND-ACP-CLAUDE-ALLOW) — 백엔드가 `acp:claude`(또는 `acp:claude/…`, acp-fallback+`claude`)인 리뷰도
+ *      ③ 을 만족하고 «같은 머리의 선택된 리뷰» 이면 착지 증거다. 같은 머리의 실패한 금지 리뷰는 후보에서
+ *      superseded 로 제외되고(supersedes 장부), 유효한 같은-머리 리뷰가 없으면 종전처럼 거부한다(fail-closed).
  *   ⓐ 이미 조상(TC #26019 실측) — 겹친 최근 착지 커밋이 «전부» 고정 머리의 조상이면 그 겹침은 이미 그 머리의 게이트·리뷰에
  *      반영됐다 ⇒ ①② 없이 ③ 만으로 통과(관측 reason `already-ancestor`). 하나라도 조상이 아니면 ①②③ 전부.
  *   ⓐ' 증거 파일이 없을 때(`verifyAncestorAutoPass`) — 같은 ⓐ 를 표준 자리 `review-results/*-<pr>-<head접두 10~40>.json` 만으로 잰다
@@ -453,6 +456,7 @@ function checkReview(input: Pick<VerifyOverlapEvidenceInput, 'pr' | 'readFile'>
   if (!review.head || review.head.toLowerCase() !== reviewHead) return { ok: false, reason: 'review-head-mismatch', baseTip };
   // The capture parser projects away model provenance; inspect the same last result-shaped line here.
   const raw = lastReviewRecord(text);
+  let acpClaudeEvidence: { actualBackend: string; model: string; reviewRoute: string } | undefined;
   if (raw) {
     if (raw.reviewer === 'OP-waiver') {
       const waiver = validOpWaiver(raw, input.pr, head);
@@ -463,10 +467,15 @@ function checkReview(input: Pick<VerifyOverlapEvidenceInput, 'pr' | 'readFile'>
     const route = typeof raw.reviewRoute === 'string' ? raw.reviewRoute.trim().toLowerCase() : '';
     const respondedProvider = typeof raw.respondedProvider === 'string' ? raw.respondedProvider.trim().toLowerCase() : '';
     const respondedModel = typeof raw.respondedModel === 'string' ? raw.respondedModel.trim().toLowerCase() : '';
+    // PRLAND-ACP-CLAUDE-ALLOW — `acp:claude` is no longer refused outright. A review that satisfies
+    // the landing contract below (same PR/head, reviewed, pass|warn, counted must-fix 0) is evidence
+    // whatever backend produced it; a failed acp:claude attempt is excluded by the same-head
+    // supersedes ledger instead of blocking every landing. This note records the provenance only —
+    // the contract below still decides, so an invalid or other-head acp:claude review stays rejected.
     if (actualBackend === 'acp:claude' || actualBackend.startsWith('acp:claude/')
       || model === 'acp:claude' || model.startsWith('acp:claude/')
       || ((route === 'acp' || route === 'acp-fallback') && typeof raw.fallbackBackend === 'string' && raw.fallbackBackend.trim().toLowerCase() === 'claude')) {
-      return { ok: false, reason: 'review-forbidden-acp-claude', baseTip };
+      acpClaudeEvidence = { actualBackend, model, reviewRoute: route };
     }
     const requested = typeof raw.requestedModel === 'string' ? raw.requestedModel.trim().toLowerCase() : '';
     if (requested) {
@@ -490,6 +499,9 @@ function checkReview(input: Pick<VerifyOverlapEvidenceInput, 'pr' | 'readFile'>
   if (review.reviewed !== true) return { ok: false, reason: 'review-not-reviewed', baseTip };
   if (review.verdict === null || !ACCEPTED_REVIEW_VERDICTS.has(review.verdict)) return { ok: false, reason: `review-verdict-${review.verdict ?? 'null'}`, baseTip };
   if (review.mustFix !== 0) return { ok: false, reason: review.mustFix === null ? 'review-must-fix-unknown' : `review-must-fix-${review.mustFix}`, baseTip };
+  if (acpClaudeEvidence) {
+    debug.log('pr.land', 'review-acp-claude-accepted', { pr: input.pr, head, reviewResult: e.reviewResult, ...acpClaudeEvidence });
+  }
   if (carry) {
     if (!input.cwd || !input.remote || !input.branch) return { ok: false, reason: 'carry-repo-unmeasured', baseTip };
     const digest = createHash('sha256').update(text).digest('hex');

package/src/cli/pr-land-pod-shadow-job.ts

@@ -3,8 +3,15 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { runPodCommand, type RunPodCommandOptions, type PodCommandResult } from '../task-orchestrator/surfaces/pod-command-job.js';
 import { redactSecretText } from '../debug/log.js';
+import { getUserConfig } from '../user-config.js';
 import type { RootPlanSummary } from './pr-land-heavy-remote.js';
-import type { WarmReuseEvidence, WarmReuseEvidenceByConsumer } from '../task-orchestrator/surfaces/pod-warm-switch.js';
+import type { WarmReuseEvidence, WarmReuseEvidenceByConsumer, WarmReuseSwitchConfig } from '../task-orchestrator/surfaces/pod-warm-switch.js';
+import { requestWarmPodReplay, finalizeWarmPodReplay, quarantineWarmPodReplay } from '../task-orchestrator/surfaces/pod-warm-worker-provider.js';
+import { assessWarmWorkerShadow, type WarmWorkerFileResult } from '../task-orchestrator/surfaces/pod-warm-worker-protocol.js';
+import { writeWarmJobManifest, warmReferenceFromJobArtifacts } from '../../scripts/release-loop/gate-warm-artifacts.js';
+import type { ActualWarmLeaseEvidence } from '../task-orchestrator/surfaces/warm-reuse-evidence.js';
+import { randomUUID } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
 
 const SHA = /^[0-9a-f]{40}$/i;
 const MARKER = 'ELANOUS_PRLAND_SHADOW';
@@ -12,7 +19,7 @@ const MARKER = 'ELANOUS_PRLAND_SHADOW';
 export const LANDING_POD_SHADOW_HOST_TIMEOUT_MS = 10 * 60_000;
 export const LANDING_POD_SHADOW_STATUS_UNREADABLE_MS = 60_000;
 
-export interface LandingPodShadowInput { head: string; main: string }
+export interface LandingPodShadowInput { pr?: number; repo?: string; host?: string; head: string; main: string }
 export interface LandingPodShadowVerdict {
   measured: boolean;
   ok: boolean;
@@ -21,9 +28,26 @@ export interface LandingPodShadowVerdict {
   gateRc?: number;
   reason?: string;
   job?: string;
+  /** Warm evidence only exists after a real worker lease and exact per-file comparison. */
+  warmEvidence?: ActualWarmLeaseEvidence;
+  warmReason?: string;
+  warmTestFiles?: string[];
 }
 
-export function landingPodShadowScript(head: string, main: string): string {
+const LAND_TEST_PATH = /^(?:[A-Za-z0-9_-][A-Za-z0-9_.-]*\/)*[A-Za-z0-9_-][A-Za-z0-9_.-]*\.test\.tsx?$/;
+export const LAND_WARM_CANARY_TIMEOUT_MS = 5 * 60_000;
+
+/** Changed test files are the bounded canary scope; no test file means no warm evidence. */
+export function changedLandWarmTestFiles(repo: string, head: string, main: string): string[] {
+  if (!SHA.test(head) || !SHA.test(main)) return [];
+  const result = spawnSync('git', ['-C', repo, 'diff', '--name-only', '--diff-filter=ACMR', `${main}...${head}`], {
+    encoding: 'utf8', timeout: 15_000, maxBuffer: 2 * 1024 * 1024,
+  });
+  if (result.status !== 0) return [];
+  return [...new Set(result.stdout.split(/\r?\n/).filter((path) => LAND_TEST_PATH.test(path)))].sort();
+}
+
+export function landingPodShadowScript(head: string, main: string, afterGate = ''): string {
   if (!SHA.test(head) || !SHA.test(main)) throw new Error('pod shadow: invalid head/main');
   return [
     'set -u',
@@ -39,17 +63,117 @@ export function landingPodShadowScript(head: string, main: string): string {
     `printf '${MARKER}_TSC_PLAN %s\\n' "$(grep '^\\[tsc-gate\\] root-plan ' /tmp/prland-shadow-tsc.log | tail -n 1 | sed 's/^\\[tsc-gate\\] root-plan //')"`,
     "tail -n 8 /tmp/prland-shadow-tsc.log; tail -n 8 /tmp/prland-shadow-gate.log",
     `printf '${MARKER} head=%s main=%s tsc=%s gate=%s\\n' '${head}' '${main}' "$tsc_rc" "$gate_rc"`,
+    ...(afterGate ? [afterGate] : []),
     'exit 0',
   ].join('\n');
 }
 
+function landWarmColdTestScript(files: readonly string[], head: string, attemptId: string): string {
+  if (files.some((file) => !LAND_TEST_PATH.test(file)) || !SHA.test(head) || !/^[0-9a-f-]{36}$/i.test(attemptId))
+    throw new Error('pod shadow: invalid warm test scope');
+  return files.map((file, index) => {
+    const prefix = `"$HOME/outbox/pr-land-warm/${index}"`;
+    const quotedFile = `'${file}'`;
+    return [
+      `mkdir -p "$HOME/outbox/pr-land-warm"`,
+      `bun test --reporter=junit --reporter-outfile=${prefix}.junit.xml ${quotedFile} >${prefix}.log 2>&1`,
+      'test_rc=$?',
+      `printf '%s' "$test_rc" >${prefix}.rc`,
+      `printf '{"commit":"${head}","attemptId":"${attemptId}","files":["${file}"],"rc":%s,"jobFailed":false,"jobExitCode":0}\n' "$test_rc" >${prefix}.json`,
+      `printf '[warm-worker] file=%s\\n[warm-worker] cut=%s attempt=%s\\n' '${file}' '${head}' '${attemptId}' >${prefix}.log.stamped`,
+      `cat ${prefix}.log >>${prefix}.log.stamped`,
+      `printf '\\n[warm-worker] junit-sha256=%s\\n' "$(sha256sum ${prefix}.junit.xml 2>/dev/null | cut -d' ' -f1)" >>${prefix}.log.stamped`,
+      `mv ${prefix}.log.stamped ${prefix}.log`,
+    ].join('\n');
+  }).join('\n');
+}
+
+async function runWarmLandCanary(input: {
+  pr: number; head: string; main: string; host: string; repo: string;
+  job: PodCommandResult; files: readonly string[]; attemptId: string; coldGatePassed: boolean;
+  timeoutMs?: number;
+  readReference?: typeof warmReferenceFromJobArtifacts;
+  requestWarm?: typeof requestWarmPodReplay;
+  finalizeWarm?: typeof finalizeWarmPodReplay;
+  quarantineWarm?: typeof quarantineWarmPodReplay;
+  warmConfig?: () => WarmReuseSwitchConfig | undefined;
+}): Promise<{ warmEvidence?: ActualWarmLeaseEvidence; reason: string }> {
+  let config: WarmReuseSwitchConfig | undefined;
+  try { config = input.warmConfig ? input.warmConfig() : getUserConfig().pod?.warmReuse; }
+  catch { return { reason: 'warm-config-unavailable' }; }
+  if (input.host !== 'node-b') return { reason: 'canary-host-mismatch' };
+  if (config?.land !== true) return { reason: 'land-canary-flag-off' };
+  if (!input.files.length) return { reason: 'changed-test-files-unmeasured' };
+  const coldFiles = input.files.map((file, index) => {
+    const prefix = join(input.job.artifactsDir, 'outbox', 'pr-land-warm', String(index));
+    const writeManifest = writeWarmJobManifest(prefix, file, input.head, input.attemptId);
+    return writeManifest ? (input.readReference ?? warmReferenceFromJobArtifacts)(prefix, file,
+      { cutSha: input.head, attemptId: input.attemptId }) : null;
+  });
+  if (coldFiles.some((row) => row === null)) return { reason: 'cold-reference-unmeasured' };
+  const requestWarm = input.requestWarm ?? requestWarmPodReplay;
+  let replay;
+  const timeoutMs = input.timeoutMs ?? LAND_WARM_CANARY_TIMEOUT_MS;
+  const request = requestWarm({ protocol: 1, runId: `land-${input.pr}-${input.head.slice(0, 8)}`,
+      attemptId: input.attemptId, cutSha: input.head, baselineSha: input.main,
+      deadlineAt: Date.now() + timeoutMs, files: [...input.files], envProfile: 'gate-v1' });
+  const timedOut = Symbol('warm-canary-timeout');
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  try {
+    const raced = await Promise.race([request, new Promise<typeof timedOut>((resolve) => {
+      timer = setTimeout(() => resolve(timedOut), timeoutMs);
+    })]);
+    if (raced === timedOut) {
+      // The provider API has no AbortSignal yet. Fence any late lease as soon as it arrives.
+      void request.then(async (late) => {
+        if (late.command) await (input.quarantineWarm ?? quarantineWarmPodReplay)(late.command, 'land-shadow-late-after-timeout');
+      }).catch(() => {});
+      return { reason: 'warm-request-timeout' };
+    }
+    replay = raced;
+  } catch (error) { return { reason: `warm-request-failed:${error instanceof Error ? error.name : 'unknown'}` }; }
+  finally { if (timer) clearTimeout(timer); }
+  const command = replay.command;
+  if (!command) return { reason: replay.transport.reason ?? 'warm-lease-unmeasured' };
+  const decision = assessWarmWorkerShadow(command, coldFiles as WarmWorkerFileResult[], replay.transport.reply);
+  const matched = decision.reason === 'match';
+  let leaseValid = replay.transport.status === 'observed' && replay.transport.reason === 'complete';
+  try {
+    if (matched) await (input.finalizeWarm ?? finalizeWarmPodReplay)(command);
+    else { leaseValid = false; await (input.quarantineWarm ?? quarantineWarmPodReplay)(command, `land-shadow-${decision.reason}`); }
+  } catch { leaseValid = false; }
+  // The reply is the worker-side observation. Falling back to the host's requested key
+  // would turn a missing worker identity into a false positive comparison.
+  const workerLockHash = replay.transport.reply?.key?.lockHash;
+  if (!command.leaseId || !Number.isSafeInteger(command.generation) || command.generation < 1
+    || !command.key.lockHash || !workerLockHash) return { reason: 'warm-lease-identity-unmeasured' };
+  return { reason: decision.reason, warmEvidence: {
+    workerId: command.workerId,
+    leaseId: command.leaseId, generation: command.generation,
+    expectedLockHash: command.key.lockHash, workerLockHash,
+    leaseValid, canaryPassed: matched && leaseValid && input.coldGatePassed, agree: matched,
+  } };
+}
+
 export async function runLandingPodShadowJob(input: LandingPodShadowInput, deps: {
   runPod?: (options: RunPodCommandOptions) => Promise<PodCommandResult>;
   readLog?: (path: string) => string;
   /** Deterministic timer seam for the host deadline. */
   armTimeout?: (onTimeout: () => void, ms: number) => () => void;
+  testFiles?: readonly string[];
+  warmReplay?: typeof requestWarmPodReplay;
+  finalizeWarm?: typeof finalizeWarmPodReplay;
+  quarantineWarm?: typeof quarantineWarmPodReplay;
+  readReference?: typeof warmReferenceFromJobArtifacts;
+  warmConfig?: () => WarmReuseSwitchConfig | undefined;
+  warmTimeoutMs?: number;
 } = {}): Promise<LandingPodShadowVerdict> {
-  const script = landingPodShadowScript(input.head, input.main);
+  let warmConfig: WarmReuseSwitchConfig | undefined;
+  try { warmConfig = deps.warmConfig ? deps.warmConfig() : getUserConfig().pod?.warmReuse; } catch { /* no warm launch without readable config */ }
+  const canaryEnabled = input.host === 'node-b' && warmConfig?.land === true;
+  const files = canaryEnabled ? deps.testFiles ?? (input.repo ? changedLandWarmTestFiles(input.repo, input.head, input.main) : []) : [];
+  const attemptId = randomUUID();
+  const script = landingPodShadowScript(input.head, input.main, landWarmColdTestScript(files, input.head, attemptId));
   const controller = new AbortController();
   const armTimeout = deps.armTimeout ?? ((onTimeout: () => void, ms: number) => {
     const timer = setTimeout(onTimeout, ms);
@@ -106,7 +230,21 @@ export async function runLandingPodShadowJob(input: LandingPodShadowInput, deps:
   if (!rootPlan) return { measured: false, ok: false, rootPlan: null, reason: 'root-plan-missing', job: job.job };
   const tscRc = Number(match[1]);
   const gateRc = Number(match[2]);
-  return { measured: true, ok: tscRc === 0 && gateRc === 0, rootPlan, tscRc, gateRc, job: job.job };
+  const verdict: LandingPodShadowVerdict = { measured: true, ok: tscRc === 0 && gateRc === 0, rootPlan, tscRc, gateRc, job: job.job,
+    ...(files.length ? { warmTestFiles: [...files] } : {}) };
+  if (input.pr && input.repo && input.host) {
+    const warm = await runWarmLandCanary({ pr: input.pr, head: input.head, main: input.main, host: input.host,
+      repo: input.repo, job, files, attemptId, coldGatePassed: verdict.ok,
+      ...(deps.warmTimeoutMs !== undefined ? { timeoutMs: deps.warmTimeoutMs } : {}),
+      ...(deps.readReference ? { readReference: deps.readReference } : {}),
+      ...(deps.warmReplay ? { requestWarm: deps.warmReplay } : {}),
+      ...(deps.finalizeWarm ? { finalizeWarm: deps.finalizeWarm } : {}),
+      ...(deps.quarantineWarm ? { quarantineWarm: deps.quarantineWarm } : {}),
+      warmConfig: () => warmConfig });
+    verdict.warmReason = warm.reason;
+    if (warm.warmEvidence) verdict.warmEvidence = warm.warmEvidence;
+  }
+  return verdict;
 }
 
 /** WARM-REUSE-LAND-CONSUMER-WIRE — land shadow Job 결과 표본(착지쌍·lock·lease·카나리아·그림자 일치). */

package/src/cli/pr-land-pod-shadow.ts

@@ -15,6 +15,8 @@ export interface HeavyOnPodShadowInput<T> {
   runPod: () => T | Promise<T>;
   log: (category: string, event: string, data: Record<string, unknown>) => void;
   warn: (message: string) => void;
+  /** Evidence persistence is best effort; it must never change the cold landing verdict. */
+  onShadow?: (observation: { pod: unknown; agree: boolean }) => void;
 }
 
 function agree(local: unknown, pod: unknown): boolean {
@@ -38,22 +40,25 @@ function elapsedMs(started: number): number {
 }
 
 export async function runHeavyOnPodShadow<T>(input: HeavyOnPodShadowInput<T>): Promise<T> {
-  const { enabled, pr, head, local, runPod, log, warn } = input;
+  const { enabled, pr, head, local, runPod, log, warn, onShadow } = input;
   if (!enabled) return local;
 
   const localMs = 0;
   const started = performance.now();
   try {
     const pod = await runPod();
+    const agrees = agree(local, pod);
     log('pr.land', 'heavy-on-pod-shadow', {
       pr,
       head,
       local,
       pod,
-      agree: agree(local, pod),
+      agree: agrees,
       podMs: elapsedMs(started),
       localMs,
     });
+    try { onShadow?.({ pod, agree: agrees }); }
+    catch (error) { warn(`shadow evidence write failed: ${error instanceof Error ? error.message : String(error)}`); }
   } catch (error) {
     warn(error instanceof Error ? error.message : String(error));
     log('pr.land', 'heavy-on-pod-shadow', {
@@ -62,6 +67,8 @@ export async function runHeavyOnPodShadow<T>(input: HeavyOnPodShadowInput<T>): P
       agree: false,
       podMs: elapsedMs(started), localMs,
     });
+    try { onShadow?.({ pod: { measured: false, ok: false, reason: `pod-exception:${error instanceof Error ? error.name : 'unknown'}` }, agree: false }); }
+    catch (writeError) { warn(`shadow evidence write failed: ${writeError instanceof Error ? writeError.message : String(writeError)}`); }
   }
   return local;
 }